.. mode: -*- rst -*- Memory protection ================= :Tag: design.mps.prot :Author: David Jones :Date: 1997-04-02 :Status: complete design :Revision: $Id: //info.ravenbrook.com/project/mps/version/1.116/design/prot.txt#1 $ :Copyright: See `Copyright and License`_. :Index terms: pair: memory protection; design Introduction ------------ _`.intro`: This is the design of the memory protection module. _`.readership`: Any MPS developer; anyone porting the MPS to a new platform. _`.overview`: The memory protection module ensures that the mutator sees a consistent view of memory during incremental collection, by applying protection to areas of memory, ensuring that attempts to read or write from those areas cause protection faults, and implementing the means for the MPS to handle these faults. Requirements ------------ _`.req.consistent`: Must ensure that the mutator sees a consistent view of memory during incremental collection: in particular, the mutator must never see objects in oldspace. (Otherwise there's no way for the MPS to interface with uncooperative code.) _`.req.prot.read`: Should allow collections to proceed incrementally, by read-protecting pages that are not consistent from the mutator's point of view. (This is the only way for the MPS to meet real-time requirements on pause times.) _`.req.prot.write`: Should allow the MPS to maintain remembered sets for segments that it has scanned, by write-protecting pages in these segments. (This improves performance by allowing the MPS to avoid scanning these segments again.) _`.req.fault.handle`: If the module implements protection, it must also provide a mechanism for handling protection faults. (Otherwise the MPS cannot take the correct action: that is, fixing references in a read-protected segment, and discarding the remembered set from a write-protected segment. See ``TraceSegAccess()``.) Design ------ _`.sol.sync`: If memory protection is not available, the only way to meet `.req.consistent`_ is to ensure that no protection is required, by running the collector until it has no more incremental work to do. (This makes it impossible to meet real-time requirements on pause times, but may be the best that can be done.) _`.sol.fault.handle`: The protection module handles protection faults by decoding the context of the fault (see design.mps.prmc.req.fault.addr_ and design.mps.prmc.req.fault.access_) and calling ``ArenaAccess()``. .. _design.mps.prmc.req.fault.addr: prmc#req.fault.addr .. _design.mps.prmc.req.fault.access: prmc#req.fault.access Interface --------- ``void ProtSetup(void)`` _`.if.setup`: Called exactly once (per process) as part of the initialization of the first arena that is created. It must arrange for the setup and initialization of any data structures or services that are necessary in order to implement the memory protection module. ``Size ProtGranularity(void)`` _`.if.granularity`: Return the granularity of protection. The ``base`` and ``limit`` arguments to ``ProtSet()`` must be multiples of the protection granularity. ``void ProtSet(Addr base, Addr limit, AccessSet mode)`` _`.if.set`: Set the protection of the range of memory between ``base`` (inclusive) and ``limit`` (exclusive) to *forbid* the specified modes. The addresses ``base`` and ``limit`` are multiples of the protection granularity. The ``mode`` parameter contains the ``AccessWRITE`` bit if write accesses to the range are to be forbidden, and contains the ``AccessREAD`` bit if read accesses to the range are to be forbidden. _`.if.set.read`: If the request is to forbid read accesses (that is, ``AccessREAD`` is set) then the implemntation may also forbid write accesses, but read accesses must not be forbidden unless ``AccessREAD`` is set. _`.if.set.noop`: ``ProtSet()`` is permitted to be a no-op if ``ProtSync()`` is implemented. ``void ProtSync(Arena arena)`` _`.if.sync`: Ensure that the actual protection (as determined by the operating system) of every segment in the arena matches the segment's protection mode (``seg->pm``). _`.if.sync.noop`: ``ProtSync()`` is permitted to be a no-op if ``ProtSet()`` is implemented. Implementations --------------- _`.impl.an`: Generic implementation in ``protan.c``. _`.impl.an.set`: ``ProtSet()`` does nothing. _`.impl.an.sync`: ``ProtSync()`` has no way of changing the protection of a segment, so it simulates faults on all segments that are supposed to be protected, by calling ``TraceSegAccess()``, until it determines that no segments require protection any more. This forces the trace to proceed until it is completed, preventing incremental collection. _`.impl.an.sync.issue`: This relies on the pool actually removing the protection, otherwise there is an infinite loop here. This is therefore not compatible with implementations of the protection mutator context module that support single-stepping of accesses (see design.mps.prmc.req.fault.step_). .. _design.mps.prmc.req.fault.step: prmc#req.fault.step _`.impl.ix`: POSIX implementation. _`.impl.li`: Linux implementation. See design.mps.protli_. .. _design.mps.protli: protli _`.impl.w3`: Windows implementation. _`.impl.xc`: OS X implementation. Document History ---------------- - 1997-04-02 David Jones. Incomplete document. - 2002-06-07 RB_ Converted from MMInfo database design document. - 2013-05-23 GDR_ Converted to reStructuredText. - 2014-10-23 GDR_ Move protection mutator context interface to design.mps.prmc_. Bring design up to date. .. _design.mps.prmc: prmc .. _RB: http://www.ravenbrook.com/consultants/rb/ .. _GDR: http://www.ravenbrook.com/consultants/gdr/ Copyright and License --------------------- Copyright © 2013-2016 Ravenbrook Limited . All rights reserved. This is an open source license. Contact Ravenbrook for commercial licensing options. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: #. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. #. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. #. Redistributions in any form must be accompanied by information on how to obtain complete source code for this software and any accompanying software that uses this software. The source code must either be included in the distribution or be available for no more than the cost of distribution plus a nominal fee, and must be freely redistributable under reasonable conditions. For an executable file, complete source code means the source code for all modules it contains. It does not include source code for modules or files that typically accompany the major components of the operating system on which the executable file runs. **This software is provided by the copyright holders and contributors "as is" and any express or implied warranties, including, but not limited to, the implied warranties of merchantability, fitness for a particular purpose, or non-infringement, are disclaimed. In no event shall the copyright holders and contributors be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of such damage.**